Extracted

• • Target

    6539a25f2cba82aa95a0326686cc6406d5893e0977af48d008d8819f5a419da8.exe

  • Size

    120KB

  • MD5

    6265f303eb2f71ca07ba209457fe950c

  • SHA1

    1fe7550e9376b1add7b580bbedce99b751cbb0d1

  • SHA256

    6539a25f2cba82aa95a0326686cc6406d5893e0977af48d008d8819f5a419da8

  • SHA512

    9cc4132540f127255c5bf761979abdf0f500c73f500276f009e13041dfcbd7b009680bcac8e25c809bbe53f5b9c73715c7e56adb0372cd140ec1f5002f8ca7ef

  • SSDEEP

    1536:8o3zMNia+Svj2Itq7w/ZOavEVLW2i5ahwLQIFVf9mOBfaBA4a1/q7sVqZD:9jMNiaYInZOavE9thikwD4a1/dV4

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2